221 rented servers were removed from the network when their unwitting owners were notified, 500,000 zombie computers were freed from remote control, 17 families of malware were deprived of c/c, and the five people who ran the botnet were arrested. The law enforcement sinkhole server, described in 2016 as the "largest ever", with 800,000 domains served, collects the IP addresses of infected computers that request instructions from the botnet so that the ISPs owning them can inform users that their machines are infected and provide removal software. Malware deprived of infrastructure The following malware families were hosted on Avalanche: Windows-encryption Trojan horse (WVT) (a.k.a. Matsnu, Injector, Rannoh, Ransomlock.P) URLzone (a.k.a. Bebloh) Citadel VM-ZeuS (a.k.a. KINS) Bugat (a.k.a. Feodo, Geodo, Cridex, Dridex, Emotet) newGOZ (a.k.a. GameOverZeuS) Tinba (a.k.a. TinyBanker) Nymaim/GozNym Vawtrak (a.k.a. Neverquest) Marcher Pandabanker Ranbyus Smart App TeslaCrypt Trusteer App Xswkit The Avalanche network also provided the c/c communications for these other botnets: TeslaCrypt Nymaim Corebot GetTiny Matsnu Rovnix Urlzone QakBot (a.k.a. Qbot, PinkSlip Bot) References External links Joint Cyber Operation Takes Down Avalanche Criminal Network (FBI) Email spammers Cybercrime Organized crime groups in Europe